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Instantaneous measurements of non-local observables between space-like separated regions can be 
performed without violating causality. This feat relies on the use of entanglement. Here we propose 
novel protocols for this task and the related problem of multipartite quantum computation with 
local operations and a single round of classical communication. Compared to previously known 
I ' techniques, our protocols reduce the entanglement consumption by an exponential amount. We also 

I ' prove a linear lower bound on the amount of entanglement required for the implementation of a 

, certain non-local measurement. 

■ These results relate to position-based cryptography: an amount of entanglement scaling expo- 

' nentially in the number of communicated qubits is sufficient to render any such scheme insecure, 

rr^, Furthermore, we show that certain schemes are secure under the assumption that the adversary has 

. less entanglement than a given linear bound and is restricted to classical communication. 

o: . 

fSJ , It is remarkable that the axioms of quantum mechanics are compatible with the severe restrictions imposed by 
relativistic causality. From the early days of quantum mechanics, this miraculous fact has repeatedly been called into 
question and has been a source of great controversy. Arguably the most well-known debate of this kind has centered 
around the Einstein-Podolsky- Rosen (EPR) paradox [1], which deals with the non-local correlations arising from a 
I ' bilocal measurement of an entangled state. 

r-| . A similar discussion originated from concerns about the compatibility of the measurement process with relativistic 
d ' quantum field theory. In 1931, Landau and Peierls [2] showed that the electromagnetic field strength cannot be 
^ I accurately measured by means of point-like test charges: an uncertainty relation implies large fluctuations in their 

, ^ / positions, which in turn leads to the emission of radiation strongly influencing the field elsewhere. From this result, 
I Landau and Peierls concluded that, quite generally, the standard measurement prescription of quantum mechanics 

ff^ . does not apply in a relativistic setting. 

^ ' Such difficulties reconciling quantum measurements with causality are strikingly apparent when considering non- 
, separable bilocal measurements (e.g., a von Neumann measurement in the Bell basis of two qubits). The instant 
collapse of the wavefunction induced by such measurements allows to signal instantly between space-like separated 
regions (see e.g., [3] for explicit examples). This may suggest that certain non-local observables are not measurable 
at a well-defined time in a fixed Lorentz frame. As a consequence, one may be led to believe that their expectation 
values do not carry any physical meaning. As with the EPR paradox, entanglement is at the root of this apparent 
causal restriction on the set of physically allowed observables, yet in this case, it is the observable (or measurement) 
instead of the state which is entangled. Somewhat ironically, entanglement also figures prominently in the resolution 
of this issue. 

Landau and Peierls' far-reaching conclusions were soon challenged by Bohr and Rosenfeld [4], who showed how 
the electromagnetic field strength can be measured using spatially extended charge distributions instead of point-like 
5^ • test charges. Much later, Aharonov and Albert [5, 6] proposed a way of measuring certain non-local variables in a 
manner consistent with causality. This involves the use of prior shared entanglement. A series of subsequent works [7- 
11] characterizing and extending this kind of instantaneous measurements culminated in a scheme by Vaidman [12], 
which allows to instantaneously measure any non-local observable. This disproves the stated existence of causality 
restrictions on non-local measurements. 

The basic achievement of such measurement schemes is illustrated in Fig. 1. Two space-like separated observers 
Alice (A) and Bob (B) sharing a bipartite system AB aim to determine a certain non-local property of their joint state 
PAB — PAsito) at a specific time Iq. This property is described by a non-local POVM with operators O = {O'^^Jj, 
and their goal is to sample from the probability distribution 

Pil) - tr(O^^p^s) . (1) 

The apparent causality problem arises when the operators constituting the measurement are non-separable. Vaidman 
shows that this sampling problem can be solved as follows (see Fig. 1): 

1. First, Alice and Bob apply local measurements at time to to their shared state pab ® VA'B'- Here tia'B' is an 
auxiliary shared entangled state. They obtain outcomes a and /3, respectively. 



o 



■ 

X 



2 




FIG. 1: Instantaneous measurement of a non-local observable Oab'- Alice and Bob share, in addition to the state pAB to be 
measured, an auxiliary entangled state rjA's' (indicated by the wiggly line). They perform local measurements £ — {i?AA'}a 
and T — {F^g,}/!, respectively. Charlie computes a function 7 = g[a,j3) of their measurement results. The measurements 
and the post-processing function are chosen in such a way that this simulates the measurement of pab with the non-local 
POVM Oab = {0\b}-,. 



2. Alice sends a and Bob sends /3 to Charlie (a point C in the intersection of the causal cones of A and B). 

3. At a later time t > to after reception of the measurement outcomes (a,/3), Charlie computes a value 7 by 
applying some function g to the pair (a, /3). 

In other words, all measurements are local and instantaneous and performed at time Iq. The output is a value 7 which 
is computed at a time t > to at C, but is supposed to pertain to a non-local measurement of pab (to) at time to- 

For any POVM {O^^It' Vaidman constructs local measurements £ = {E'^j^,}a and ~ {Pbb'}i3 ^^'^ ^ postpro- 
cessing function g such that the distribution 

P(7) ^ {(^AA' ® FBB')iPAB ® VA'B')) 

is close to the distribution (1). Entanglement therefore allows to estimate expectation values of non-local observables 
at a specific instant in time without violating causality. 

Beyond realizing the statistics of non-local measurements, Vaidman's scheme also provides an instantaneous im- 
plementation of non-local operations. Here the goal is to apply a (non-local) unitary Uab to the joint state pab of 
Alice and Bob. They are restricted to applying local operations and only a single round of simultaneously passed 
classical communication, see Fig. 2. This very limited form of interaction acts as a non-signaling constraint and makes 
this task non-trivial for general unitaries. Again, Vaidman's techniques demonstrate that prior shared entanglement 
allows to implement such non-local operations. This fact was first recognized in [13], where it was used to address a 
problem in cryptography. 

Explicitly, a general protocol in this model proceeds as follows (see Fig. 2): 

1. Alice and Bob simultaneously apply (partial) local measurements {E'X^}a and {Fg_^}p to the joint state pab ® 
rjA'B' , where rjA' B' is the shared entanglement. Here we have partitioned Alice's complete system AA' into 
subsystems Ai and A2, and similarly for Bob. 

2. Alice and Bob then simultaneously communicate a and /3 to each other. 

3. Subsequently, Alice applies a local postprocessing CFTP map M"'^ : B{A2) -> B{A) chosen according to the 
measurement outcomes (a,/3). Bob similarly applies a postprocessing CFTP map .jV"'^ : B{A2) — >■ 13(B). 

Vaidman's scheme gives, for every unitary Uab, measurements and postprocessing operations such that the final state 
after these operations is close to UabPabU\q. 

Our focus here is on the amount of shared entanglement required for the implementation of such primitives. 
Assuming that A and B consist of n qubits each, we give procedures which solve these tasks to arbitrary constant 
precision while consuming 0(n2^") ebits of entanglement. In contrast, earlier schemes based on Vaidman's ideas 



3 




FIG. 2: Instantaneous implementation of a non-local unitary Uab on a bipartite state pab using the shared entangled 
state rjA'B'- Alice and Bob perform local (partial) measurements £ = {E'X_^}a and = {-F^^}^ where A1A2 = AA' and 

B1B2 = BB , respectively. This results in the residual state P^'^b^ trAiSi ((Ia2®S2 ® ®F^,) {pab(Sva'b')) M«,/3) 
with probability p{a, 13) = tr^^lA2®S2 ® ^E) Fg_^^ {pab <X"7a's'))- According to the (communicated) measurement re- 
sults (a,/?), Alice and Bob apply local post-processing operations M"'^ and respectively. The measurements and 
postprocessing operations are chosen such that the resulting average state pab = Y.c.,0Pi^^P) (-^"'^ ® ■^'"'^) (P A, So ) close 
to the target state UABPABU\g. 



require an amount of entanglement scaling doubly exponentially with n. Our protocols are considerably simpler 
because they are based on a modified version of teleportation proposed by Ishizaka and Hiroshima [14, 15]. 

It is worth emphasizing that our procedures only use the POVM {O^^i '-'^ the unitary Uab as a black box (and 
do not depend on their particular form) , and moreover are universal in the sense that the number of required ebits is 
independent of the particular measurement or unitary that is implemented. For specific instances, much more efficient 
schemes are known: in [3] , it was shown that it is possible to realize a non-local unitary U by consuming an amount of 
entanglement exponential in M, where M is the length of a factorization of J7 = i?i • • • Rm hito Pauli rotations {Rj}j. 
Note, however, that for a generic n-qubit unitary, M is exponentially large in n, and then our scheme again provides 
an exponential saving for a typical unitary. 

On the negative side, by constructing a specific example, we show that a linear number of ebits is generally 
insufficient to perform an instantaneous distributed measurement. This impossibility result improves upon [13], 
where it is shown that a certain such task cannot be performed without shared entanglement. 

Our results significantly tighten previously known upper and lower bounds on the amount of entanglement required 
for instantaneous non-local measurement and computation, but still leave an exponential gap. We conjecture that 
the entanglement scaling of our protocols is essentially optimal among protocols which only make black-box use of 
the unitary or measurement, as explained above. 

These results have direct application to position-based quantum cryptography, which attempts to exploit the lo- 
cation of an entity as its only credential. Our techniques show that any such scheme is insecure in the presence of 
malicious players sharing an amount of entanglement exponential in the number of communicated qubits. This was 
previously known only when the amount of entanglement is doubly exponential [13]. 

On the other hand, we prove the security of certain protocols assuming that the adversarial players have less 
entanglement than a given linear bound and are restricted to classical communication. We show that under these 
assumptions, certain protocols have exponential soundness, i.e., the adversarial players have a negligible probability 
of cheating successfully. In contrast, previously known security proofs achieving exponential soundness [13] do not 
allow any prior entanglement (while also requiring the restriction to classical communication, see discussion after 
equation (15) below). 

We present two types of protocols with exponential soundness assuming limited entanglement and classical commu- 
nication: the first one relies on the impossibility of implementing a certain high-dimensional instantaneous measure- 
ment, whereas the second one is obtained by parallel composition and reduction to the case of adversaries without 
prior entanglement. The latter scenario was previously analyzed in [13]. It gives rise to a protocol which can be 
realized using single-qubit manipulations only. 

The restriction to (unlimited, but) classical instead of quantum information is natural in the study of resource re- 
quirements for instantaneous measurement and computation. Indeed, allowing (unlimited) quantum communication 
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would render instantaneous measurements trivial. Also, given an implementation of an instantaneous quantum com- 
putation, quantum communication can easily be traded against a corresponding increase in prior entanglement (using 
teleportation) . However, in position-based quantum cryptography, the restriction to classical communication is less 
natural: ideally, security should be established even in the case where the adversaries are allowed to communicate an 
arbitrary amount of quantum information. Such strong results are currently only known with constant soundness and 
a zero or constant amount of prior entanglement. Establishing similar results for e.g., a linear amount of entanglement 
and exponential soundness is a major open problem in this context. The following table summarizes this state of 
affairs: 



soundness 


allowed communication 


pre-shared ebits 


reference 


constant 


quantum 


zero/constant 


[13, 16] 


exponential 


classical 


zero 


[13] 


exponential 


classical 


linear 


Lemma V.2/Lemma V.4 


exponential 


quantum 


e.g., linear 


open problem 



I. REVIEW OF VAIDMAN'S SCHEME: TELEPORTATION WITHOUT COMMUNICATION 

We briefly discuss the implementation of a bipartite unitary Uab using Vaidman's scheme [12]. While this is not 
directly needed for the discussion of our scheme, it helps to clarify the nature of our simplifications. In particular, in 
Section I C, we will discuss how the doubly exponential scaling of the entanglement consumption arises in Vaidman's 
procedure. 

Vaidman's scheme assumes that Alice and Bob share a large supply of EPR pairs \^)a'B' — -^(|0)yi' |0)b' + 

This entanglement can in principle be used for teleportation [17]: to teleport a qubit state to Bob, 
Alice measures A and her part A' of an EPR pair in the Bell basis. She obtains each outcome k G {0, 1, 2, 3} with equal 
probability 1/4. We will refer to such a measurement as a teleportation measurement. Conditioned on her outcome 
being k, Bob's register B' contains the state ak\'^)A, where {(Ti}f^o are the Pauli operators. Standard teleportation 
then proceeds by Alice sending k to Bob, and Bob applying the correction operation cr^. 

Clearly, n shared EPR pairs can be used to teleport an arbitrary n-qubit state |\1/): Alice's teleportation mea- 
surement is a tensor product measurement between each qubit and one half of an EPR pair. It gives each outcome 
k G {0,1,2,3}" with probability 4~". Bob's state in his part of the EPR pairs then ends up being (Tk|^')A, where 
CTk — (Tki ® ■ ■ ■ <E) crfc„. Sending k e {0, 1, 2, 3}" to Bob allows him to apply the Pauli correction CTk. 

In a setting with free classical communication, applying a unitary to their joint state would easily be achievable 
using teleportation: Bob teleports n qubits (system B) to Alice using n ebits of entanglement. Alice applies Uab 
and teleports the system B back to Bob. However, teleportation cannot directly be used for instantaneous non-local 
computation because outcomes of teleportation measurements cannot be communicated. To get around this problem, 
Vaidman uses an elaborate recursive technique which we explain in Section IB. 

A. Reduction to a state held by one of the parties 

It is instructive to see that, while teleportation is not directly applicable in the setting of instantaneous measurement, 
it can nevertheless be used advantageously. In the following we show that in order to implement a bipartite unitary U — 
Uab applied to a state l^*) = \'^)ab G (C^)'^"(g)(C^)'*" it suffices to provide a protocol V' with the following properties: 
it proceeds by application of local operations only (no communication is allowed) and after completion of the protocol. 
Bob holds the state crgf^l^') hi one of his registers, and Alice and Bob have classical information a and (3 (measurement 
outcomes) that together determine s — s{a, (3) E {0, 1, 2, 3}^". If we design such a V', the procedure of implementing 
the unitary U on l^*) is immediate: 

l.a Alice and Bob run V' , getting classical outcomes (a,/3) and the state asU\'^) in Bob's registers B'iB2, where 
s =(«,/?). 

l.b Bob performs a teleportation measurement on B[ and n EPR pairs shared between Alice and Bob in registers 
A" : B". He obtains the outcome v £ {0, 1, 2, 3}". 

2 Alice sends a to Bob. Bob sends (3 and v to Alice. 

3 Alice and Bob both compute s — s{a, (3). Let s = (s^, sb) £ {0, 1, 2, 3}" x {0, 1, 2, 3}". Alice applies CTs^cTv to A" , 

while Bob applies CTs^ to i?2- 
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At the end of this protocol AUce and Bob share U\^) in A" : B'2. 

B. Vaidman's recursive scheme 

We now show how Vaidman reahzes a protocol V as described in the previous section. Even though the final 
measurements are done instantaneously and simultaneously, it is useful for the construction to think of an interactive 
procedure. Since no communication is allowed in V' and Alice and Bob's measurements commute, this interactive 
protocol is indeed instantaneous. 

In the first round, Bob performs a teleportation measurement on B and his part of n ebits in registers A'^ : B[. 
Conditioned on the outcomes being ti e {0,1,2,3}", Alice now has the state (I^i (8) crtJI^') in AA'^. Since Alice is 
ignorant of ti, she cannot apply the corresponding correction operation. Instead, she simply applies C/'-^-' = U to her 
state, and then performs a teleportation measurement between the resulting state and 2n ebits in registers A'( : B'( 
shared between Alice and Bob. Denoting by si e {0, 1, 2, 3}^" be the outcome of Alice's measurement. Bob holds the 
state (Js-JJ(J-A fti)|^) in his register B'(, which can be written as 

f/if)(ti)tf/|*) where C/if)(ti) = f/(lA at Jf/Vs, . (2) 

Clearly, if ti = 0", then ?7i?(ti) = (j^^. This means that Bob has a state of the desired form and can stop. In the 
actual protocol, this means that Bob does not perform further measurements. However, ti = 0" happens only with 
probability 4"". 

Vaidman's crucial insight was that it is possible to recursively apply this procedure, essentially attempting to imple- 

ment C/s\ (ti) in the next round. However, this is not entirely straightforward since Bob's measurement outcome ti 
(unlike Si) is unknown to Alice. To get around this, Alice and Bob use, for every possible outcome ti of Bob's 
measurement result, a separate set of 2n ebits in registers A'^ ^ '■ ^'li ^'^^ Bob's teleportation measurements, and 
2n ebits in registers ^"j^ : "^i ti ^'^^ Alice's measurements. In essence, this allows Alice to implement operations which 
effectively depend on the outcomes ti of the previoiis round. She just applies, for each ti, a suitably chosen operation 
to registers A'^^^ and A'^^^^ which may depend on ti. Because Bob holds ti, he knows which pair (-^^ ti ' -^i ti-' 
registers is the relevant one containing the desired state. 

Explicitly, in the second round. Bob performs a teleportation measurement on B'l and his part of the 2n ebits A'^ : 
B'^ Let t2 e {0, 1, 2, 3}^" be the corresponding outcomes. He does not use the other registers. Then Alice, for each 
ti e {0,1, 2, 3}", applies [/sV(ti) to register A' 3. and performs a teleportation measurement between A' - and A'! ^ 
getting outcome S2(ti). At the end of these operations, Bob, in register t^, holds 

Ui%^{t,M)^U\^) where Ui%^{t,M) = C/i?(ti)at,f/if)(ti)V,, (3) 

where S2 = S2(ti), and he neglects other registers B'' , ti 7^ ti. Similarly as before, if t2 = 0^", which happens with 

probability 4^^", Bob has (JsaC/l^) and has reached the goal. Note that the total number of ebits used in the second 
round is 4n • 4" . 

It is clear how to continue this recursion: in the i?-th round, Alice and Bob use, for every possible sequence 
(ti , . . . , t B_i) of Bob's outcomes in the previous rounds, 2n ebits A' ^ ^ : B' ^ ^ and 2n ebits A'! ^ ^ : 

^ ' ' " ^ ' l,ti,...,tjj_i l,ti,...,tR_i l,ti,...,tK_l 

"^iti iu r Bob performs a teleportation measurement between ti, .. .,tfi_2 ^'^^^^^P^^^^^^^^^^^^^^^^i.tL-.-.tR-i • 
-Si,ti,...,tfi_i- For each sequence (ti, . . . ,tfl_i), Alice applies the unitary f4i^§2,...,§^_,(ti, . . . ,ti{_i) to ^'^ ti,...,tH_i 
where Sj = Sj(ti, . . . , tj_i). She also performs a teleportation measurement between A'^ ^ and her part of the 

2n ebits A'/, , B'' . , . Bob, in register , ends up with 

l,ti,...,tji_i l,ti,...,tR_i ° r- 

t^i^!+.!i«(ti,...,tii)^t^|*) where 
t^i^^.tKti, . ..,tR) = t^i^!L,SR_.(ti, • • • ,tH_i)at«f/i/^.)..,,,_,(ti, . . . ,t,i_i)tas« . (4) 

Each round leads to a trivial correction operation = 0^" with probability 4~^". As soon as Bob obtains this 
outcome in some round R, he stops performing any further measurements. Alice, on the other hand, continues 
applying her operations until she has operated on all the entangled states available to the two parties. 

The classical information a sent by Alice consists of the sequence of all her measurement results {sj(t)}j,f Bob's 
message /3 consist of the number of rounds R and all his measurement results (ti, . . . , tij). Bob holds asfiU\^) in 
-^iti ...tB_i' where is determined by (a,/3), as required. 
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C. Entanglement consumption in Vaidman's scheme 

The amount of entanglement required in R rounds is roughly proportional to the number of sequences (ti, . . . , tfl_i) 
and therefore exponential in R. Since the probability of success in each round (except the first round which is 4~") 
equals 4~^", to reach the success probability 1 — e, R needs to be roughly log(l/£) • 2"'". As a result, the amount of 
required entanglement for a constant e is doubly exponential in n. 

Clearly, the reason for this unfavorable behavior is the recursive structure of the protocol, which is a consequence 
of the non-interactive way the teleportation correction operations are dealt with. Our simplified schemes avoid these 
problems altogether by making use of a different kind of teleportation scheme whose correction operations are in some 
sense trivial. In particular, the resulting scheme is non-recursive. 

II. PORT-BASED TELEPORTATION 

In this section, we review a form of teleportation introduced by Ishizaka and Hiroshima [14, 15]. To distinguish this 
kind of teleportation from the better known usual scheme, we borrow from their terminology and call this port-based 
teleportation. 

A. Teleportation without correction 

The goal of port-based teleportation is to achieve teleportation with simpler correction operations on Bob's side. 
Instead of being able to apply arbitrary Pauli operations, we assume that Bob can only perform the arguably simplest 
imaginable CPTP map depending on classical information. That is. Bob can discard any subsystem of his choosing 
according to the classical information received from Alice. 

Remarkably, teleportation is still possible in this restricted setting using a more intricate measurement on Alice's 
side. Concretely, Alice wants to teleport a qudit state from her system A = to Bob's system B = C*. 

We assume that Alice and Bob share N copies of the maximally entangled state |$) — -^^i^i |«)|*) in registers 
A[ : B[,A'2 : B'2, . . . , A'^ : B'j^. We fix an orthonormal standard basis in each of these spaces. The protocol proposed 
in [14] then proceeds as follows: 

1. Alice performs a certain POVM {-E^^^/wji^i on her systems, where A'^ = A!^ - ■ ■ N^. She sends the result i to 
Bob. 

2. Bob discards everything except the subsystem B\ and calls it B. This register is supposed to hold the state l^*). 

Let : B{A) — > B{B) be the CPTP map described by this protocol taking the original state \^) a to Bob's 

system B ■ = i? by using auxiliary entanglement |<i>)^^. (Here B{A) denotes the set of bounded linear operators on a 
Hilbert space A.) Explicitly, this map is given by 

N 

f|<i,)8iv(pA) = X!^^S'«\B|tr^A'"((lB'«(»£^^A'")(PA®|$)($|f,«B,iv)) • (5) 

2=1 

In this expression, trs/jv^s' '■ B{B'^) — > B{B) denotes the CPTP map consisting of tracing out all systems except B'l = 
B. The main result of [14, 15] is that there exists a choice of a POVM {-E^^/wli such that this CPTP map is close 
to the identity channel for large N. 

The measure of distance used in [14, 15] to compare a channel £ : B{A) — > B{B) to the identity channel Ia ■ 
B{A) B{A) = B{B) is the entanglement fidelity 

F(£)=ii\<^){^Bc{£®Ic)mmAc) , (6) 
where |$) is the maximally entangled state. Because of the relation [18] 

{F{£)d+l)/{d+l)= j {^£m{^m , 

between entanglement fidelity F{£) and the output fidelity averaged over the Haar measure on all pure input states, a 
lower bound on (6) expresses how well £ preserves quantum information for random inputs on average. The following 
is shown in [14, 15]. 
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Theorem II.l ([14, 15]). Let |$) = -^T,i=i ION) be the maximally entangled state. There is a POVM {E\^,j^}f^^ 
on (E) (C^)^^ such that the CPTP map defined by (5) satisfies 

f > 1 



N 

Due to the importance of port-based teleportation to our schemes for instantaneous computation, we give a detailed 
derivation of Theorem II.l in A. 

Instead of measuring average-case closeness to the identity channel, it is desirable to have worst-case bounds. In 
other words, we would like to show that the state on B at the end of the port-based teleportation scheme is close to 
the original input state on A for all inputs. This requires using a distance measure different from the entanglement 
fidelity (6). A natural distance measure on the set of CPTP maps is the completely bounded trace norm or diamond 
norm denoted 11 • 11 o- This norm is defined in terms of the trace norm 



||L||i =tr\/ItL , L e B{A) . 

The trace norm induces a norm 

\\n\\i= max \WL)\\i 

LeBiA):\\L\\i<l 

on the set of superoperators fl : B{A) — > B{B). The diamond norm is defined as 

|lf)|U = sup||r!0lc'=lli (7) 
fc>i 

where l£k is the identity (super)operator on i5(C'^). 

Given two CPTP maps £ : B{A) — )■ B{B) and J- : B{A) B{B), \\£ — is a natural measure of their distance 
because of the following operational interpretation. The quantity 

is equal to the probability of successfully distinguishing £ from T when a single instance of either one of these channels 
is provided with equal prior probability. This implies that the diamond-distance can only decrease under composition 
of maps. 

Corollary II. 2. Let 1$) = X^^Li maximally entangled state. There is a POVM {£'^^/jv}iLi on 

^ (C'')'^^ such that the CPTP map £|$^»]v defined by (5) satisfies 

V N 



Proof. Consider a superoperator VI : B{A) B{B) and let C ^ A. The Choi-Jamiolkowski representation [19, 20] 
of Vl is the operator 

J{n) := (n®Ic)m{^\Ac) ■ 

J(ri) is a quantum state if is a CPTP map. Since J(l£d) = \^){^\, the entanglement fidelity F{£) is equal to the 
overlap of the states JiX^d) and J(5), i.e., 

F{£)^ii{J{Icd)J{£)) . 
Because J(Ic<i) is pure, we can use the general inequality (see e.g., [21]) 

^||p-|*)(*|||i<v/i-(*|p|*> 

bounding the distance between a pure state Y^) and a mixed state p. We conclude that 

i|| J(£|*)««) - J(Ic<*)||i < - F{£) . (8) 



The claim then follows from the linearity of the map J, inequality (8) and the following lemma applied to 57 

£\i^-^%N — I^d. 



□ 
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Lemma II. 3. For every two CPTP maps Vti,Vl2 : B{A) B{B) we have 

W^i - n2\\o < 2(dim A)|| J(r!i) - J(r!2)|li . 

Proof. Let fl — fli — and C = A. It is well-known (see e.g., [22]) that for any such ft 

\\n\\^ = \\n(g>Ic\\i =niax|*)^^ ||(l]®Ic)(l«')(*l)l|i 

= 2max|^^^p_o<PBc<ii3c tr(PBc(f^®^c)(|*)(*|)) . 

On the other hand, for every |4')yic there exists Mc such that |5')y!ic —^a^ Mc\^)ac, where due to normalization 
tr mIMc = dim A. Then we have 

n(E)Ic{\'f){'9\)^lB<E)McJ{n)BciB<E}Ml . 

As a result, 

^2inaxMc,a<Pnc<iBc tr ((Is » mIPbc^b ® Mc)J{n)Bc) 

< 2va&y.Mc,o<PBc<iBc \\Ib®mIPbcIb®Mc\\oo ■ \\J{n)Bc\\i 
<2(dimA)||J(r!)Bc||i , 

where || • ||oo denotes the operator norm, and in the last line we use the normalization of Mc- d 

III. PROTOCOLS FOR INSTANTANEOUS MEASUREMENT AND COMPUTATION 

Here we propose and analyze two novel protocols for instantaneous measurement and computation. Both protocols 
depend on a parameter N which captures the amount of entanglement consumed and the accuracy achieved by 
the protocol. The first protocol 7rjv(0) gives an instantaneous realization of a (non-local) POVM O = {0^b}7. 
The second protocol t:n{U) implements a non-local unitary Uab- In the following descriptions, we divide up the 
instantaneous (simultaneous) application of measurements by both Alice and Bob into several stages to simplify the 
analysis. Note, however, that the actions of Alice and Bob commute and do not have to be performed in the prescribed 
order. 



Protocol 7rAr(C'): implementation of POVM O = {0\g}^ on a state \'^)ab e (C^)®" (g> (C^)®". 

Alice and Bob share n ebits of auxiliary entanglement in A' : B' , and for every j e {1,...,A^}, 2n ebits 
of entanglement in A'^ : B'J . We write A"^ = A'l • • • A'^ and B"^ = B^' • • • B^. 

1(a). Bob performs a teleportation measurement between B and B' with outcomes t G {0,1,2,3}". As a result, 
Alice holds the bipartite state (Ia (8) at)\'^)AA'- 

1(b). Alice applies the port-based teleportation- measurement on her 2n qubits in systems A A' and her part of the 
shared entanglement in A"^ : _B"^. She gets an index i E {1, . . . , N}, and Bob obtains (1^ (g) crt)|^) (with 
high fidelity) in the z-th system B'/ . 

1(c). For each j G {1, . . . , N}, Bob first applies I(E)(Jt to B'J and then measures it using the POVM O. Let -fj be 
the outcome of this measurement. 

2. Alice sends i, and Bob sends the list {(j, 7j)}j to Charlie. 

3. Upon receiving this classical information, Charlie outputs 7^. 
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Protocol ttn{U): implementation of a unitary Uab on a state \'^)ab e (C^)"*" (K) (C^)"*" 

Alice and Bob share auxiliary systems A'A"^ : B' B"^ as in protocol -^^{0). Here we assume that each 
A'- is partitioned into an A-part and a i3-part (with n qubits each), and similarly for B'- . They additionally 
share, for every j £ {!,..., A^}, n ebits of entanglement in systems A'" : B'J' . 

l(a)-l(b). Execute steps 1(a) and 1(b) of protocol 7tn{0). 

1(c). For every j S {1, . . . , N}, Bob applies U (IiXxrt) to B'J . Then he performs a (usual) teleportation measurement 
between the v4-part of B" and B'J'. Letting vj £ {0, 1, 2, 3}" be the outcome of this measurement, systems 
A'-' and the B-part of B'- now contain {a^^ (g)I)C/|^') (with high fidelity). 

2. Alice sends i to Bob, and Bob sends the list {{j, to Alice. 

3. Alice discards everything except A'^" , on which she applies CTv • Bob discards everything except the i?-part 
ofSf. 



To quantitatively express the accuracy of these protocols, we use the diamond norm. For this to make sense 
for POVMs, we regard a POVM £ — {Ei}i as a CPTP map with output diagonal in the standard basis, i.e., 
£{p) = X^i tr(£'ip)|i)(i|. The following theorem is an easy consequence of Corollary II. 2 and the fact that the 
diamond-distance does not increase under the composition of CPTP maps. 

Theorem III.l. The protocols introduced in this section have the following properties for any £ > 0. 

(i) Let O = {Olg}-y be a bipartite POVM on (C^)*^" ® (C^)^^". Set N := 2^"+^/e^ and let M be the POVM defined 
by protocol ttn{0). Then A4 approximates O up to accuracy 

\\M-0\\^ < e 

and consumes 

ebits of entanglement. 

(a) Let U = Uab be a bipartite POVM on (C^)®" ® (C^)®". Set N := 2^''+^/e^ and let £ be the CPTP map defined 
by protocol ttn{U). Then £ approximates U up to accuracy 

\\£-U\\o<e 

while consuming 
ebits of entanglement. 

These protocols and their analysis can clearly be extended in a straightforward manner to multipartite (i.e., more 
than bipartite) non-local POVMs and unitaries. 

IV. A LOWER BOUND 

In this section, we show that there is a measurement on 2n qubits which is not realizable instantaneously with 
fewer than n/2 ebits of entanglement. Our construction is based on mutually unbiased bases. A pair of orthonormal 
bases {|e;J,)}^^i and {|e^)}$j^i of is called mutually unbiased if 

l(ei|eg)|2 = i for ah x, y G {1, . . . , d} . 

It is known [23-25] that if d = p" is a power of a prime number, then a set of d -|- 1 pairwise mutually unbiased 
bases {Ba ■= {\s'^)}x=i}1i=o exists in C*. We will assume that d is of this form (specifically d = 2"). 
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Theorem IV. 1. Suppose that two parties Alice and Boh share one of the states 

d 



a=0 



Is X 



e {i,...,d} , 



each with prior probability l/d, and additionally have an (arbitrary) shared entangled state rjA'B'- They are asked to 
output X with an instantaneous measurement (cf. Fig. 1). Then their success probability is upper bounded by 



Psucc — 



2dimB' 



(9) 



Proof. Because of the hnearity of the success probabihty as a function of the input ensemble, it suffices to prove the 
bound (9) in the case where Ahce and Bob receive |a) and |e") respectively, each with probability l/d{d+ 1). 

Since Alice's input A is a classical register (containing a), we may assume without loss of generality that her 
message a to Charlie is determined by measuring the register A' using a POVM which depends on a. Letting 

{F^g,}^ be Bob's measurement and g be the classical post-processing function, the success probability is equal to 



d(d+ 



d{d+l 



where 



Using 



we have 



Tg, < tr(T5', )Ib' 



< tr(F|5,)||Ea,atr(r^f)|e^(„^^))(e^(„,^)|B®Is' 

d(d+l) ^''(-^SB') Ea,a ^'"(■''b' ) I ^g(Q,0)) ('^g(a,/3) I ^ 



If we show that 



a, a 

the claim of the theorem follows because 



<^ + i 



P^"""^"^ - d(d+l)^/d ^n^BS'J 



Vd 



'13 \ _ d+Vd.+2 



for every /3 



tr Ibb' 



d(d+l)\/d 

= £?+Vi±2dimB' < . 

{d+l}Vd — Vd 

It remains to prove (11) for a fixed /3. Consider the (not necessarily normalized) vector 



\V}br = \^^<^BnKia,0))B ® \a,a)R 



(10) 



(11) 



where R is an auxiliary Hilbert space with orthonormal basis {\a, a) ii}a,a- Denoting by M the matrix of interest 
in (11), we have 



lAfll 



\t^R\V){V\ 



BR\ 



\tTB\V){V\ 



BR\ 



Ea,a'...o' V'tr(r-")tr(r^'-') (e^;„, |e^(„_^)) |a, a)(a', a'| 
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On the other hand, by a simple triangle inequality we obtain that for every matrix {cij)ij, ||(cij)ij- ||oo ^ ||(|cij|)i,j|loo, 
where | • | denotes the absolute value of a complex number. Therefore, 



||A/||oo < M + J^ 



where 



\l tr(T^f ) tr(T^'/"')|a, a) (a', < 



a, a' .a. a' 



and 



The first summand can be bounded as 



pi < ^ tr (r°f) ^ 51 t^ltrA' Va'B' 



d+l 
Vd 



To bound the second term, we use the direct sum property ||C© -D||oo — max{||C||oo, Halloo}, the triangle inequality 
and the easily verified fact that 

lli^lloo < \\K + L\\^ 
for real symmetric matrices K and L with nonnegative entries. This gives 



v — max 



< max 



1 

1 



XI V tr(T^f ' )|a, a)(a, a'| 



< (1 H ^)max 



X! V ^^■(^b") tr(T-Bf ')|a, a) {a, a'\ 

a, a' 

(1 + ^) maxy^trfrj^',") = 1 + 



(12) 



□ 



Combining (IV) and (12) yields (11). 

This result may be expressed in terms of the diamond norm. Let {Ua}a=o be the set of unitaries that rotate the 
standard basis into a set of such mutually unbiased basis, i.e., Ua\x) = je^) and let 

d 



a=0 



Then 



Oab = {O, = {Ia ^ \x){x\B)UAByLi 
is a POVM that exactly outputs x under a randomly chosen Pab- 



(13) 
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Corollary IV. 2 (Impossibility of instantaneous measurement). Let M.ab = {Mx}x be an instantaneous measurement 
on implemented with shared entanglement tja'B' as in Fig. 1. If dim B' < e\fd, then 

\\Mab-Oab\\o > 2(1 -2e) , 

where Oab is the POVM (13). 
Proof. Define 

PXAB = Pab ■ 

X 

Then due to the definition of the diamond norm we have 

\\Mab ~ OabWo > W^x <S> Mab{pxab) - -S) Oab{pxab)\\i 

^(1 ~~ Psucc) 

> 2(1 - 2e) , 

where Psucc denotes the probability that Mab successfully finds x, and in the last line we use Theorem IV. 1. □ 



V. IMPLICATIONS FOR POSITION-BASED QUANTUM CRYPTOGRAPHY 

Position-based cryptography revolves around the idea of using the geographical location of an entity as its only 
credential. One of the most basic position-based primitives is position- verification: Here a prover P tries to convince 
a set of verifiers {Vi}^^i that he is at a specific location fo £ in space (I? = 3 is of most interest in practice, 
of course). Proposed protocols for this problem usually assume that the verifiers are located throughout space at 
different positions fy, (such that rg is e.g., in the convex hull of {rVi}i) and have synchronized clocks. They proceed 
by applying distance bounding techniques [26] : the verifiers send challenges to P and obtain bounds on their distance 
to P by measuring the time taken for his responses to arrive. All computational processes are assumed to be essentially 
instantaneous, that is, fast in comparison to the ratio between the desired spatial resolution and the speed of light. 

A number of classical protocols for position-verification have been proposed in the past (see e.g., [13] for a list 
of references), but it was shown in [27] that security is unachievable by any classical protocol without additional 
assumptions if there are colluding adversaries (at different locations). Position- based quantum cryptography attempts 
to overcome this impossibility using quantum cryptographic techniques. Its history is somewhat reminiscent of the 
study of bit commitment: this primitive was also known to be classically unachievable and the use of quantum 
cryptographic techniques appeared promising for a while. Then, Mayers [28], and Lo and Chau [29] showed that 
secure bit commitment is generally unachievable in a quantum setting. We refer to [30] for a nice introduction to 
the basic ideas of position-based quantum cryptography with examples of simple attacks on specific schemes. Further 
attacks on previously proposed schemes were found by Lau and Lo in [16], and a general impossibility proof was given 
by Buhrman et al. [13] based on Vaidman's techniques for instantaneous measurements. 

The impossibility of secure position-based quantum cryptography has motivated the search for schemes secure under 
additional assumptions. Since known attacks rely on entanglement shared between colluding adversaries, it is natural 
to limit the amount of entanglement available to adversaries. In [13], a position-based scheme was shown to be secure 
under the assumption that the adversaries share no entanglement. In [16], a security proof for a scheme was given 
that relies on the assumption that the adversaries share entanglement in the form of a two- or three-level system. 

Our results on instantaneous quantum computation tighten the impossibility result of [13] by reducing the amount 
of entanglement required for a successful attack to an exponential (instead of doubly exponential) amount. On the 
positive side, we provide a single-round protocol which is secure if the adversaries share less entanglement than a given 
linear bound and are restricted to classical communication. We also relate the security of a protocol in the setting of 
no prior shared entanglement to its security in the case where the adversaries have a limited amount of entanglement 
(and are otherwise unrestricted). This implies for example that the multi- round protocol of [13] remains secure even 
if the adversaries share less than a linear amount of entanglement. 

To illustrate the main points, we focus on the problem of position- verification in Z) = 1 dimension. We assume that 
the (honest) prover is at a location rg between the two verifiers Vi and V2, i.e., ry^ < < ry^ and wants to convince 
them of this fact. We consider protocols which satisfy the following correctness condition: if P is located at rg, he 
can always make the verifiers accept. A colluding set of adversaries {Pi}f£i may try to convince the verifiers that 
at least one of them is at location ro, while in fact, none of them actually is, {rp, — ro] > A (where A is the desired 
spatial resolution). The figure of merit is the soundness of such a protocol. Following [13], we say that a protocol 



13 



for position-verification is e-sound if any colluding set of adversaries {Pi}f^i cannot make the verifiers accept with 
probability more than e. 

For concreteness, we discuss the following protocol 7r„ for position-verification. It depends on a parameter n and 
involves, as in Section IV, a set of unitaries {Ua}i^i taking the computational basis of C'' to d mutually unbiased 
bases, where c? = 2". 



Protocol 7r„(ro): position-verification proving that P is at jq G K 

Vq and Vi are at positions rvg < tq < ry^ and share common (secret) randomness in the form of uniformly 
distributed bit strings a,x £ {0, 1}". 

1. Vq sends a to P and Vi prepares the state Ua\x) and sends it to P. The timing is chosen such that both the 
classical information and the quantum state arrive at tq at the same time. 

2. P measures the state in the basis {|e°)}i, getting measurement outcome x E {0, 1}". He sends x to both Vq 
and Vi. 

3. Vq and Vi accept if they receive x at times consistent with x being emitted from tq in both directions 
simultaneously (instantaneously after a and Ua\x) reach ro), and x ^ x. 



It is easy to check that this protocol is correct in the sense defined above. This and similar protocols have 
been studied in a series of papers [13, 16, 30-32]. The motivation for considering such protocols originated from 
the no-cloning principle. It seems to suggest that to successfully convince the verifiers, some cheating adversaries 
have to clone the (classical) information x without knowledge of the basis this information is encoded in. It was 
realized early on, however, that this intuition is misleading because entanglement between colluding adversaries can 
render such schemes insecure. That is, consider two colluding adversaries Pi,P2 located on either side of tq, with 
rvi < Tp < ro < rp < ry^- We assume that their distance [rp, — ro\ > A from tq is larger than the desired spatial 
resolution A. We further assume that they share entanglement. Specializing the results of [13] to the protocol 7r„(ro) 
and using our version of instantaneous computation then gives 

Lemma V.l. Protocol 7r„(ro) is not e-sound against Pq and Pi if they share n ^1 + ^^_^yi ^ ebits of entanglement. 

Proof. To attack the protocol, Pq and Pi are faced with the analogous challenge as Alice and Bob in the situation 
described in the proof of Theorem IV. 1 (with d = 2" instead of c? -I- 1 mutually unbiased bases). The soundness 
parameter e is equal to the success probability of correctly guessing x based on an instantaneous measurement of 
their state p^^. Since the non-local POVM O defined by (13) does so with certainty, it suffices to approximate this 
POVM by an instantaneous measurement with accuracy 1 — e in diamond norm. The claim therefore follows from 
Theorem III.l (i). □ 

In contrast, the results of [13] rely on Vaidman's techniques, and therefore only show insecurity if Pq and Pi share 
a doubly exponential (in n) amount of entanglement. The same proof technique applies to more general protocols, 
including multiple parties, see [13]. 

On the positive side, we prove security of the protocol 7r„(ro) against adversaries limited as follows: they share 
fewer than n/2 ebits of entanglement and are restricted to classical communication. 

Lemma V.2. For n > 1, the protocol 7r„(ro ) is2- 2™-"/2-soMn(i against adversaries Pq and Pi sharing at most m 
ebits of entanglement and communicating only classical information. 

Proof. As in the proof of Lemma V.l, we can upper bound the soundness of the protocol 7r„(ro) by Alice and Bob's 
success probability in the setting of Theorem IV. 1. Adapting the proof of the latter shows that the upper bound (9) 
holds even if d = 2" instead of d -I- 1 mutually unbiased bases are used. The claim follows immediately. □ 

The protocol 7r„(ro) may not be very practical if n is large because it requires even honest parties to manipulate 
n qubits at a time. It has, however, the appealing feature that it consists of only one round of communication 
between the verifiers and the prover and nevertheless achieves exponential security. In the setting where quantum 
communication is allowed, we may ask whether and how this degree of security could be achieved with a similar 
one- round protocol. Answering this may prove challenging because of the locking effect [33]. 
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To obtain a more practical protocol with exponential security, we can consider multi-round protocols: sequential 
composition decreases the soundness error of a protocol. For example, it is shown in [13] that the protocol tt := 7ri(ro) 
is e-sound (even when allowing quantum communication) with 

£ = £(7ri(ro),0) < 1-/^-1(1/2) < 1 , (14) 

if there is no shared entanglement between Pq and Pi. Here we write to signify absence of entanglement and h{p) — 
— plogp— (1 — p) log(l — p) is the binary entropy function. (Wc point out that similar results were found in [16] for a 
constant amount of prior entanglement, that is, qubits or qutrits.) Equation (14) implies (see [13, Corollary 2]) that 
the L-fold sequential composition 7r°^ has exponentially small soundness error 

£(7r°^,0) <e(^,0)'^ < (1-/1-1(1/2))^ (15) 

if the adversaries share no entanglement and are restricted to classical communication between rounds. The restriction 
to classical communication is necessary as the adversaries could otherwise distribute and use an arbitrary amount of 
entanglement in the course of attacking the composed protocol. 

We now show that sequential composition of a protocol can provide exponential security even in a setting where the 
adversaries have a linear amount of entanglement. This is based on the following relation between the no-entanglement 
setting and the case of a limited amount of entanglement. 

Lemma V.3. Consider a protocol tt achieving position-verification with soundness error £(7r, 0) in the case where the 
adversaries share no entanglement. In a setting where the adversaries share an (arbitrary) entangled state rjA'B', its 
soundness error e{7r, rjA'B') is upper hounded as follows: 

e{Tr, r]A'B') < dimA' dim B' • e(7r, 0) . 

Proof. Without loss of generality, we may assume that the protocol tt takes the following form. In a first step, a 
quantum state pabst is distributed, with the adversaries Pq, Pi holding A and P, respectively, and the verifiers Vq 
and Vi holding S and T. This step is followed by various (arbitrary) actions of the adversaries alternating with actions 
of the verifiers as prescribed by the protocol. We can describe this by a CPTP map J- acting on the initial state and 
the entanglement shared by the adversaries. Finally, a binary valued measurement {P, I — P} (where < P < I) is 
applied to the resulting state. Its outcome determines whether or not the verifiers accept. The soundness error of a 
protocol TT when Pq and Pi have a shared entangled state t^a'B' can then be expressed as 

e(7r,7?A'S') = niaxtr(PJ"(/9ABST (8) ?7A'B')) ■ (16) 

Here the maximum is over all CPTP maps compatible with the protocol, i.e., resulting from combining an arbitrary 
cheating strategy of the adversaries with the fixed actions of the verifiers. 

We use the same kind of proof strategy as before (cf. (10)), replacing shared entanglement by the completely mixed 
state. Let F* be the optimal POVM achieving the maximum on the rhs. of (16). Then 

e{Ti, rjA'B') =i'c{ET*ipABST(S) rjA'B')) 

<tT{ET*{pABST®lA'B')) 

= dim A' dim P' tr (P J"* {pabst ®Oa'B')) 

where Oa'B' is the completely mixed state on A' B' . But this expression is equivalent to simply having shared 
randomness between the adversaries. This implies that 

tr{Er*{pABST®OA'B')) < e(^,0) 
and the claim follows. □ 

Combining (15) with Lemma V.3, we obtain the following statement. 

Lemma V.4. Consider two adversaries sharing an arbitrary entangled state rjA'B' on (C^)'*'^ (C^)'^'^ and restricted 
to classical communication. The L-fold sequential composition 7ri(ro)°^ of the protocol 7ri(ro) is e-sound if 

^^2fc + loglA ^^^^^ 6^1-h-\l/2). 
log 1/(5 

Lemma V.4 and Lemma V.2 give roughly the same scaling for the maximal amount of tolerable prior entanglement 
as a function of the soundness parameter. However, the protocol of Lemma V.4 is arguably more practical. 
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Appendix A: Derivation of port-based teleportation 

In this appendix, we give a proof of Theorem II. 1 by Ishizaka and Hiroshima [14]. We mostly follow [14] and 
first show the equivalence of port-based teleportation to the problem of distinguishing a certain set of states in 
Appendix Al. In Appendix A 2, we present a general lower bound on the success probability of the so-called pretty 
good measurement [34]. Combining these two facts in Appendix A3 we obtain Theorem II. 1. 



1. From port- based teleportation to distinguishing quantum states 

The crucial observation made by Ishizaka and Hiroshima is the fact that the fidelity of port-based teleporta- 
tion achieved by a certain POVM {-E^^,jv}i^i is directly related to a quantum hypothesis testing problem: It is 
a simple function of the average success probability when using the POVM to distinguish a certain ensemble of 
states {ilAA"^'^i=i ^ith equal prior probabilities. The following lemma expresses this fact. 

Lemma A.l (Equivalence of port-based teleportation with hypothesis testing [14]). Let ]<!>) — 

maximally entangled state. Let AA'^ BB'^ = (C*)^ «) (C*)^ and define the states 

ll'^trB:.y^B'^^){^l^,^,^ (Al) 

on A'^ ® Bi = A'^ ® B = A'^ ® A for i = 1, . . . , N using the canonical isomorphism between A and B. Consider a 
POVM {Ei on AA'^ ^ ® (C*)^ and let 



1 ^ 

Psucc= j;^^^T:{E'ri') 



he the average probability of successfully distinguishing the states {ri^}^i with uniform prior distribution using this 
POVM. Let £ = : B{A) — > B{B) be the port-based teleportation map (5) associated with the POVM. The 

entanglement fidelity of this CPTP map satisfies 

N 

-^(^) — Psucc ■ 

Proof. Fix an orthonormal basis for systems A = B ^ C ^ A'^ = B'^ = . We write Ea = Fb for two operators Ea 
and Fb acting on isomorphic Hilbert spaces A and B if their matrix elements in the computational basis coincide. 
The entanglement fidelity of £ is equal to 

F{£)^tYPBc{£®Ic){PAc) , 

where P = is the projection onto the maximally entangled state ]$) = -^X^iLiK)!*)- Omitting identity 

operators and tensor products for ease of notation, we have 

F{£) = E.=i tr Psc trB-« \Bj tr^^,« E\^,„Pac\^){^ ® ^ 

= Z^ili ti' Pbc trAA'« E\^,j^PacVa'nb 

= Yh=1^^ PBcE\^,NPAC'n\>N B ■ 

For every operator X we have 

{X®l)P = {1®X^)P and P{l®X) = P{X^ ®l) , (A2) 
where X'^ is the transpose of matrix X (with respect to the standard basis). Then 

PbcE'aa'^ Pac = Pbc {E'ca"^ )^'' Pac 

= PBc{{E^BA'^f^f^ Pac 

^PbcE's^,^Pac (A3) 
Reinserting (A3) and using the fact that the partial trace of P is the fully mixed state we obtain 

N 



i—1 



□ 
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2. A lower bound on the success probability of the pretty good measurement 

Having reduced port-based teleportation to a hypothesis testing problem, it remains to show that there is a suit- 
able POVM solving the latter. Concretely, we need to provide a POVM {E^}fL^ that distinguishes the family of 
states defined by (Al). Ishizaka and Hiroshima [14, 15] show that the pretty good measurement 

-1/2 . . _i/2 

E" = ly^rf \ JyM I for i = 1, . . . , iV (A4) 



does so with sufficiently high success probability 

ftTc = ^Et'^(^V) • (A5) 

i=l 



Here we rederive and generalize their bound on the quantity (A5): we derive a general lower bound on the success 
probability of the pretty good measurement for any (uniform) family of states {-^i??'}^! (see Lemma A. 3 below). 
We will apply this bound to port- based teleportation in Appendix A3. 
Our main technical tool is the following inequality. 

Lemma A. 2. Let X and Y be non-negative operators on two (not necessarily identical) Hilbert spaces, satisfying 

trX = trVY . 

Then 

trX'> ^I'J^' . (A6) 
rankA tr r 

Proof. For every non-negative operators X, Y and a, 7 > 0, we have 

a-tiX^ > f'^ 2iT:X - 1 , (A7) 

V rankA ^ ^ 

7.2trVy >3-^5(^-try2 . (A8) 

These inequalities follow easily from 

X^ > 2X — IsuppX , 

2Vy > 3r - , 

and rescaling. (Such inequalities have previously been used e.g., in [35, Eq. (32)] for channel coding). Using ti X = 
tr VY we obtain 



t,X^ >- - ^--^tiY' , 
a Q;^(try)'^ 

and the claim follows by letting a = (^ ..arikj/ti y^ ) ■ '-' 
The proof of the lower bound on the success probability of the pretty good measurement is now straightforward: 

Lemma A. 3. Consider an ensemble of states {-^, ri^}fLi- The success probability (A5) of the pretty good measurement 
is bounded by 



2 rankX 



Nr tr 

where 

N , N 



T] = — E^ if and r = — rznkif 

i=l i=l 



It is easy to check that 



17 

Proof. Define the (unnormalized) operators 

PiQ =T,f=i\^){^\i(^V' 
y = tr/ piQ , 

X = (i,®y)-V4p/Q(i/®r)-i/4 . 

pgm _ J_ , ^2 

-Fsucc — N ^'^ ^ 

tiX =tr(tr/X) =tTVY . 
The claim then follows from Lemma A. 2 using ran 

3. Proof of Theorem II. 1 

To prove Theorem II. 1, we combine the reformulation of Lemma A.l with the lower bound on the success probability 
of the pretty good measurement (Lemma A. 3). 

According to Lemma A.l, we need to consider the problem of distinguishing the states 

^'' = |$>($UjB® , (A9) 

where p = I/d is the completely mixed state. We have 

tr(|$)($U.B®PAi) {PA[ ® |$)($U^b) - , 

and then 

ti{f]'f = 1/d^-i 

ti Tj'rf =l/(fi ■ l/d^-2 , for i 7^ j . 

As a result, 

tr f]^ - 



for the ensemble average fj — j^'^i'rt- Furthermore, we have f ~ rankyy^ = d^^^. Using Lemma A. 3, we conclude 
that 



-r^SUCC — 



N \^ 



1 + 



N 



In particular, according to Lemma A.l, this implies that there is a POVM {E\j^,N}f^^ such that the associated CPTP 
map E\,^)tg,N achieves port-based teleportation with entanglement fidelity 

A'' - 1 

F(f|^)««) = ^pr,^->1-^^, 

as claimed. 
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